Dropbox and FDA 21 CFRPart 11

11.10Controls for Closed
Systems

Requirements
Persons who use closed systems to create, modify,maintain, or transmit electronic records shall employ
procedures and controls designed to ensure theauthenticity, integrity, and, when appropriate, theconfidentiality of electronic records, and to ensure that thesigner cannot readily repudiate the signed record as notgenuine.
Such procedures and controls shall include the following:

For more detail on Dropbox security features and policies, please review the Dropbox Business Security Whitepaper.

11.10 (a)Requirements
Validation of systems to ensure
accuracy, reliability, consistentintended performance, and theability to discern invalid or altered
records.

How Dropbox Supports Compliance
Processing integrity is at the core of the Dropbox Business andDropbox Education services. Dropbox has implemented
several processes and controls to validate that each file andPaper doc maintains its integrity and is not corrupted during
each step of the process: creation, upload, processing, storage,download, and deletion.
For more information, please see the System andNetwork Summary in the latest SOC 2 Type II
attestation, which addresses the SOC 2 Trust Services
Criteria for Processing Integrity and Availability.

For more detail on Dropbox security features and policies, please review the Dropbox Business Security Whitepaper.

11.10 (b)Requirements
The ability to generate accurate andcomplete copies of records in bothhuman readable and electronic form
suitable for inspection, review, andcopying by the agency. Persons
should contact the agency if there are
any questions regarding the ability of
the agency to perform such review
and copying of the electronic records.

How Dropbox Supports Compliance
Dropbox maintains internal controls, user processingcontrols, and security controls to ensure that users areable to inspect, review, and copy electronic records.
Dropbox logs user and administrator log-on and filesharing activities for Dropbox Business users. Dropbox
makes the logs available to administrators in industry
standard read-only format.
For more information about admin permissions, please
see this Help Center Article and the Monitoring andSystem Operations section in the latest SOC 2 Type II
attestation.

For more detail on Dropbox security features and policies, please review the Dropbox Business Security Whitepaper.

11.10 (c)Requirements
Protection of records to enable theiraccurate and ready retrieval
throughout the records retention
period.

How Dropbox Supports Compliance
Dropbox file data and Paper docs are encrypted and stored
on Dropbox Infrastructure and AWS, respectively. Dropbox
file data is replicated across multiple data centers. Dropbox
performs full backups of metadata and Paper doc data. The
admin dashboard maintains a complete audit log of dates,
times, and information about who accessed files and docs
and from what location. Documents can be accessed byauthorized users at any time during the retention period.
For more information, please see the Availability section of ourlatest SOC 2 Type II attestation and these Help Center Articles
on Monitoring team sharing activity and recovering deletedfiles.

For more detail on Dropbox security features and policies, please review the Dropbox Business Security Whitepaper.

11.10 (d)Requirements
Limiting system access toauthorized individuals.

How Dropbox Supports Compliance
Dropbox maintains security controls that restrict any
unauthorized distribution, access to, or use of electronicallystored records. Dropbox provides administrator controls
over end-user account authentication, registration, and deprovisioning. These functionalities ensure that onlyauthorized individuals are able to access Dropbox files,folders, and Paper docs.
Dropbox also maintains user communications and productcontrols to enable Dropbox admins and team users toprotect against unauthorized access. Within the Dropbox
admin dashboard, administrators can easily manage teammember access to files, folders, and Paper docs. For
shared file links, Dropbox’s link permissions feature allows
users to password protect the shared links, set expiration
dates to grant temporary access, and limit access to thosewithin the organization.
For more information about Dropbox’s security controls
and user communication, please see the Logical andPhysical Security section and Communications section in
the latest Dropbox SOC 2 Type II attestation.

For more detail on Dropbox security features and policies, please review the Dropbox Business Security Whitepaper.

11.10 (e)Requirements
Use of secure, computer- generated,time-stamped audit trails to
independently record the date and timeof operator entries and actions thatcreate, modify, or delete electronicrecords.
Record changes shall not obscurepreviously recorded information. Such

How Dropbox Supports Compliance
Dropbox audit logs and activity reports can help support user
record keeping. Activity report entries include date and time of
the action, the member that initiated the action, details about
the event itself, and the location and IP address of the user that
initiated the action.

audit trail documentation shall be
retained for a period at least as long asthat required for the subject electronic
records and shall be available for agency
review and copying.

For more information, please see these Help Center Articles
about monitoring file activity at Dropbox and viewing team
activity in the admin console.

For more detail on Dropbox security features and policies, please review the Dropbox Business Security Whitepaper.

11.10 (f)Requirements
Use of operational system checks toenforce permitted sequencing of steps
and events, as appropriate.

How Dropbox Supports Compliance
Dropbox allows organizations to define business processes,
including sequencing of steps and events, as appropriate for
their electronic records. These steps can be enforced
throughout user organizations to ensure consistency andcompliance.

For more detail on Dropbox security features and policies, please review the Dropbox Business Security Whitepaper.

11.10 (g)Requirements
Use of authority checks to ensure that
only authorized individuals can use thesystem, electronically sign a record,
access the operation or computer system
input or output device, alter a record, orperform the operation at hand.

How Dropbox Supports Compliance
Dropbox maintains security controls that restrict any
unauthorized distribution, access to, or use ofelectronically-stored records. Dropbox service can beaccessed only by individuals who own the account orauthorized by the team administrator for an
organization/business. Files or folders can only beaccessed by users, and their Dropbox Business (Standard,Advanced, or Enterprise) or Dropbox Education
administrator(s), who:
• Have the file or folder listed in their own Dropbox filedirectory• Have received a link to the file or folder that has been
initially shared by a user who had the file listed in theirown Dropbox directory or byDropbox Business (Advanced or Enterprise) teamadministrator(s) who:
• Use the “Sign In as User” functionality provided to themin the Administrator Console
At this time, Dropbox and Dropbox Sign do not offer
compliance support under 21 CFR Part 11 specific toelectronic signatures.
For more information about Dropbox security controls, please
see the Logical and Physical Security section in the latest
Dropbox SOC 2 Type II attestation.

For more detail on Dropbox security features and policies, please review the Dropbox Business Security Whitepaper.

11.10 (h)Requirements
Use of device (e.g., terminal) checks todetermine, as appropriate, the validity ofthe source of data input or operational
instruction.

How Dropbox Supports Compliance
Processing integrity is at the core of the Dropbox Businessand Dropbox Education services. Dropbox has implemented
several processes and controls to validate that each file andPaper doc maintains its integrity and is not corrupted during
each step of the process: creation, upload, processing,storage, download, and deletion. This applies to desktop,web, or mobile clients.
For more information, please see the Processing Integrity
section in the latest Dropbox SOC 2 Type II attestation.

For more detail on Dropbox security features and policies, please review the Dropbox Business Security Whitepaper.

11.10 (i)Requirements
Determination that persons who develop,
maintain, or use electronic record/electronic
signature systems have the education,
training,and experience to perform their assigned

How Dropbox Supports Compliance
Dropbox provides information and support to customers bymaintaining blogs, a help center, forums, and through theDropbox website and applications.

tasks.

A description of the Dropbox Business and Dropbox
Education systems and their boundaries is available tousers via the Dropbox help center and the Dropbox
Business Security Whitepaper on the Dropbox website.
Details made available through the Dropbox website
include features, usage guidelines, and additionalinformation.
Dropbox’s and our customers’ security and confidentiality
responsibilities are communicated via the Shared
Responsibility Guide on the Dropbox website and through a
combination of online documents, which include installation,setup, and configuration guidelines.

For more detail on Dropbox security features and policies, please review the Dropbox Business Security Whitepaper.

11.10 ( j )Requirements
The establishment of, and adherence to,written policies that hold individuals
accountable and responsible for actions
initiated under their electronic signatures,in order to deter record and signaturefalsification.

How Dropbox Supports Compliance
The establishment of, and adherence to, written policies that
hold individuals accountable and responsible for actions
initiated under their electronic signatures, in order to deter
record and signature falsification.

For more detail on Dropbox security features and policies, please review the Dropbox Business Security Whitepaper.

11.10 (k)Requirements
Use of appropriate controls over systems
documentation including:(1) Adequate controls over thedistribution of, access to, and use of
documentation for system operationand maintenance.
(2) Revision and change control
procedures to maintain an audit
trail that documents
time-sequenced development andmodification of systems documentation.

How Dropbox Supports Compliance(1) Dropbox maintains security controls that restrict any
unauthorized distribution, access to, or use ofelectronically-stored records. This includes but is not
limited to authentication requirements, accessrequirements, end-user account authentication,registration, and deprovisioning, file and dataencryption, malware protection, and vulnerabilitypatching.
For more information, please see the latest Logical andPhysical Security section in the latest Dropbox SOC 2 TypeII attestation.
(2) Dropbox maintains security controls and user
processing tools that log user and administrator activity,including activity such as viewing Dropbox accountinformation or actions taken on Dropbox accounts. For
Dropbox Business and Dropbox Education plans,
Dropbox logs user and administrator log-on and filesharing activities, as well as account provisioning, deprovisioning, and any “sign in as user” activity. This
allows users to maintain and track audit trails of any
revisions or changes to system documentations.
For more information about monitoring file activity inDropbox, please see this Help Center article.

For more detail on Dropbox security features and policies, please review the Dropbox Business Security Whitepaper.

11.10Controls for Open
Systems
Requirements
The company shall employ procedures andcontrols designed to ensure theauthenticity, integrity, and confidentiality ofelectronic records from the point of theircreation to the point of their receipt. Suchprocedures and controls shall include those
identified in 11.10, as appropriate andHow Dropbox Supports ComplianceIn addition to the controls outlined in Section 11.10, Dropbox
implements controls to validate and ensure the integrity ofDropbox files and Paper docs.
For more information, please see the Processing Integrity
section in the latest Dropbox SOC 2 Type II attestation.

additional measures such as document
encryption.

For more detail on Dropbox security features and policies, please review the Dropbox Business Security Whitepaper.

Disclaimer

We’re pleased to provide information to help support ourcustomers’ compliance with FDA 21 CFR Part 11. However,
the information above is not intended to be legal advice. We
recommend you consult an attorney if you have any legalquestions.

For more detail on Dropbox security features and policies, please review the Dropbox Business Security Whitepaper.

10.23